Snippets
Team reference: copy-paste code, how the platform works underneath, and the defaults we hold to.
Code
Copy, paste, adapt.
Python
Standard-library patterns for ops scripts: CLIs, log parsing, percentiles, HTTP with timeouts, retries and concurrency.
- Script skeleton
- Parse key=value log lines
- Count and group
- A small record type
- Print an aligned table
- Latency percentiles
- HTTP request with a timeout
- Retry with exponential backoff and jitter
- Run checks in parallel
- Find OOMKilled containers
- Read files: plain, gzip, stdin, JSON lines, CSV
- Full script: log analyzer
- Unit-test the analyzer
Go
Standard-library Go for ops tools: parsing, counting, percentiles, HTTP with timeouts, retries, concurrency, file reading, a full log analyzer and tests.
- Script skeleton
- Structured JSON logs
- Parse key=value log lines
- Count and group
- A small record type
- Print an aligned table
- Latency percentiles
- HTTP request with a timeout
- Retry with exponential backoff and jitter
- Run checks in parallel
- HTTP server with graceful shutdown
- Find OOMKilled containers
- Read files: plain, gzip, stdin, JSON lines, CSV
- Full program: log analyzer
- Unit-test the parser
Bash
A script template, retries, waits, parallelism, locking, atomic writes, jq and kubectl one-liners, triage commands and the mistakes that bite.
- Safe script header
- Script template
- Log one-liners
- Retry with exponential backoff
- Wait until something is ready
- Run commands in parallel
- Write files atomically
- Prevent overlapping runs
- jq for kubectl output
- kubectl one-liners
- Disk and process triage
- Certificate and port checks
- Troubleshooting commands
- Mistakes to avoid
Terraform
Terraform building blocks: remote state, a locked-down S3 bucket, workload identity and keyless CI on AWS, GCP and Azure, and safe refactoring.
Kubernetes and PromQL
Production manifests and queries: resource sizing, zone spreading, disruption budgets, secret mounts and the alerts worth having.
How it works
Architecture explained plainly, and the gotchas that bite in production.
From kubectl apply to a running container
What each control plane component does when you apply a Deployment, from the API server and etcd to the kubelet and container runtime.
Controllers, informers and reconcile loops
How Kubernetes controllers and operators work: level-triggered reconciliation, informers, owner references, finalizers, leader election and status.
Nodes: kubelet, containers and cgroups
What a container is, how requests and limits become cgroups, QoS and eviction, probes, pod shutdown, and what exit codes 137 and 143 mean.
Pod networking and CNI
How packets move between pods, what the CNI does, how Services work, and the networking gotchas behind real outages.
Services and EndpointSlices
ClusterIP, NodePort, LoadBalancer, headless and ExternalName compared, how EndpointSlices connect them to pods, traffic policies, and the exposure risks auditors ask about.
Cilium vs kube-proxy
How kube-proxy's modes and Cilium's eBPF dataplane route Service traffic, when replacing kube-proxy pays off, and the migration gotchas.
Storage and CSI
How a PersistentVolumeClaim becomes a disk mounted in a pod, what the CSI driver does at each step, and the gotchas that lose data or block pods.
Network layers and load balancers
The OSI layers that matter, L4 vs L7 load balancing, where TLS terminates, keeping the client IP, and the load balancer limits that fail quietly.
Service meshes
What a mesh gives you, sidecar vs ambient vs eBPF, Istio vs Linkerd vs Cilium, whether you need one, and the gotchas that make meshes hard to run.
GitOps architectures
Push vs pull delivery, where ArgoCD runs, repo layouts, app-of-apps vs ApplicationSets, promotion, secrets and the gotchas that bite.
Terraform architectures
How to split state, lay out environments, share data between stacks, write modules and run Terraform from CI - plus the gotchas that destroy what you meant to keep.
Policy as code: RBAC, OPA Gatekeeper, Kyverno
What happens to a request before it reaches etcd, what RBAC can't enforce, and one policy written three ways: ValidatingAdmissionPolicy, Kyverno and OPA Gatekeeper.
Falco for compliance
Falco runtime detection mapped to PCI DSS, SOC 2, ISO 27001 and NIST 800-53, with a tested Helm baseline, evidence-safe tuning and the gotchas.